topic Re: Receiving TCP TLS data Help in Getting Data In

Where to put .PEM file after data accepted?

Marco_Develops — Thu, 10 Feb 2022 03:37:48 GMT

Right now I have a Syslog Server Sending me security events. The Syslog server is sending the data with TLS encryption.

I have the PEM file, so that Splunk can do the three way handshake and accept my data.

My question is, where do I put that .PEM file.

Currently my Inputs.conf file looks like this:

[tcp-ssl:520] serverCert = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem sslPassword = PASSWORD

My Server.conf file looks like this:

[sslConfig] enableSplunkdSSL = true sslPassword = $************************** sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem

My certificate is stored in C:\Program Files\Splunk\etc\auth\mycerts

What am I missing? Any help is appreciated

Thank you,

Marco

Re: Receiving TCP TLS data Help

PickleRick — Fri, 04 Feb 2022 19:16:56 GMT

Either your cert is your cert or CA's cert. If you're not authenticating your peer you don't need CA cert anyway.

3-way handshake is in TCP layer. TLS negotiation is a bit more complicated.

Did you restart your splunkd process? Did you check log for errors (for example mistyped filenames or wrong file permissions)? Is splunkd listening on port 520? (Bonus hint - if your process is running with a non-root user it won't bind to low port) Did you try to connect with openssl client?

Re: Receiving TCP TLS data Help

Marco_Develops — Tue, 08 Feb 2022 15:52:59 GMT

Hi @PickleRick,

Thank you for the clarification on the certs. I believe what I am doing is incorrect so my question is:

If you had to send data from a server via TCP-TLS to Splunk. Where would you start?

Thank You,

Marco

Re: Receiving TCP TLS data Help

PickleRick — Tue, 08 Feb 2022 17:11:15 GMT

For tcp-ssl input you define a tcp-ssl stanza.

As a minimum, if you have unencrypted cryptographic material, it's enough to do, for example

[tcp-ssl:1514]
serverCert=$SPLUNK_HOME/etc/certs/whatever.pem
index=my_index
sourcetype=my_sourcetype

As I wrote before, remember that if you're running splunk as a normal user (non-root), you won't be able to bind to a low (<1024) port.

After defining such input, do a restart of your forwarder, verify that it's listening on the port and try to connect from remote with openssl s_client.